Skip to main content
A tool takes values from three different places, and the difference matters for security as much as correctness.

dynamic

The model fills these in from the conversation. Untrusted input.

static

Never seen by the model. Sent on every invocation.

automatic

Filled by the platform. The live call’s ID, for instance.

Choosing the right map

The rule of thumb: does this value describe what the caller wants, or who is asking?
clinicId is static deliberately. If it were dynamic, a caller could talk the agent into booking at a different clinic. Anything identifying who is asking — tenant IDs, account scoping, API versions, feature flags — belongs in staticParameters, where the model can neither see nor invent it.
A parameter name may appear in only one of the three maps. Reusing a name across two is rejected with 400, because which value wins would be ambiguous.

Dynamic parameters

enum
required
string, number, boolean, object, or array.
string
Written for the model, not for a developer. “The customer’s order number, usually eight digits” beats “order identifier” — it lets the agent notice when a caller has misread six digits and ask them to repeat.
string[]
Constrain to a fixed set. Better than describing the options in prose, because the model cannot drift outside it.
Validate every dynamic parameter server-side. These values came from speech recognition — treat them exactly as you would input typed by an anonymous user.

Static parameters

Constant values attached to every invocation and never exposed to the model.
value accepts any JSON — string, number, object, array.

Automatic parameters

Filled by the platform at call time.
KNOWN_PARAM_CALL_ID is what makes long-running tools possible — your worker learns which live call to post a result back into.

Where the value goes

HTTP tools need a location on every parameter. Both the short and canonical long forms are accepted; the long form is what reaches the runtime. Path parameters must match a placeholder in baseUrlPattern:
Client tool parameters have no location — nothing is being placed into an HTTP request. Declare schema and required only.